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Time  Series  Analysis  of  Networks:  Evaluating  the 
Effectiveness  of  Sanctions  on  Iran 

Lauren  Kewley  and  Daniel  Evans 


Abstract 


The  team  developed  a  time  series  analysis  method  to  examine  how  a  network  changes 
over  time.  Provided  time-stamped  data  is  available,  a  timeline  of  a  network’s  structure 
can  be  built  and  analyzed  using  node  and  network  centrality  measures.  A  set  of  sample 
data  is  used  to  illustrate  that  analyzing  the  effectiveness  of  past  sanctions  on  the  Iranian 
nuclear  program  can  be  leveraged  to  develop  more  effective  sanctions  in  the  future. 

Background 

Iranian  government,  financial,  and  business  entities  are  adapting  to,  and  learning  from, 
each  new  round  of  international  sanctions.  When  a  sanction  is  imposed,  agents  and 
organizations,  predictably,  develop  creative  methods  to  bypass  it  in  order  to  continue 
the  pursuit  of  nuclear  weapons  production.  Based  on  this  scenario,  can  we 
quantitatively  model  the  evolution  and  “learning”  of  this  Iranian  Network? 

This  was  the  question  posed  to  three  summer  apprentices  at  the  Network  Science 
Center  over  the  course  of  their  internship  during  the  summer  of  2012.  Based  on  team 
discussions,  the  group  developed  three  possible  methods  to  formulate  and  analyze  this 
issue.  The  following  network-based  techniques  were  introduced  in  a  previous  paper: 
standard  network  analysis,  time  series  analysis,  and  network  flows  [1],  This  paper  is  the 
second  in  this  series. 

Introduction 

Existing  sanctions  in  place  since  1979  have  been  incrementally  broadened  by  the 
United  States  since  2005  after  Iran  reinstated  its  nuclear  enrichment  program  [2],  These 
sanctions  have  been  further  reinforced  by  the  United  Nations  (UN)  and  by  European 
and  Asian  nations  since  2007.  However,  some  US  sanctions,  like  the  1996  Iran 
Sanctions  Act  (ISA),  “caused  differences  of  opinion  between  the  United  States  and  its 
European  allies  because  it  mandates  US  imposition  of  sanctions  against  foreign 
firms”[3].  The  objective  of  the  sanctions  was  to  target  specific  terrorism  efforts  in  Iran  as 
well  as  dissuade  them  from  continuing  their  efforts  to  develop  a  nuclear  weapons 
program  including  ballistic  missiles  by  targeting  specific  Iranian  industries.  These 
targeted  or  “smart”  sanctions  were  not  intended  to  negatively  impact  ordinary  Iranian 
people.  As  such,  London’s  International  Institute  for  Strategic  Studies  (IISS)  reported 


that  “sanctions  imposed  against  Iran  have  thwarted  Tehran’s  efforts  to  develop  and 
produce  long-range  ballistic  missiles  capable  of  striking  potential  targets  in  Western 
Europe  and  beyond”  [4],  However,  some  contend  that  sanctions  would  begin  to 
backfire  and  damage  the  Iranian  economy.  As  negative  impacts  on  the  Iranian 
economy  have  grown  with  each  new  round  of  sanctions,  some  argue  that  economic 
power  is  becoming  consolidated  into  the  hands  of  the  Islamic  Revolutionary  Guard 
Corps  (IRGC),  a  special  military  force  with  direct  ties  to  the  Supreme  Leader,  Ayatollah 
Ali  Khamenei;  giving  them  an  increasing  stake  in  the  Iranian  economy  in  order  to 
continue  pursuit  of  the  nuclear  weapons  program  as  the  regime’s  top  resource  priority 
[5], 

Methodology 

The  team  explored  the  use  of  a  time  series  analysis  in  order  to  analyze  how  a 
hypothetical  network  might  react  and  evolve  to  the  imposition  of  sanctions.  A  time- 
series  analysis  allows  analysts  or  decision  makers  to  examine  a  network  over  several 
time  intervals.  This  allows  them  to  determine  the  characteristics  of  a  network  before 
and  after  an  event.  When  a  change  is  made  to  a  node  or  link,  the  network  structure  is 
also  altered.  A  change  could  constitute  a  deletion,  an  addition,  or  an  alteration  of 
weight  but  is  not  limited  to  one  of  these  courses  of  action.  By  analyzing  the  network  at 
several  time  intervals,  it  is  possible  to  determine  how  the  network  reacted  to  a 
perturbation.  This  technique  is  useful  in  order  to  analyze  the  effectiveness  of  a  sanction 
or  other  targeted  act,  such  as  military  action. 

Ultimately,  we  will  compare  the  network’s  structure  and  its  corresponding  centrality 
measures  over  time.  Centrality  measures  are  numerical  representations  of  various 
attributes  of  an  individual  node.  For  example,  if  our  time  step  were  one  year,  we  would 
compare  the  attributes  of  the  2005  network  to  the  2006  network.  These  comparisons 
lend  themselves  to  sensitivity  analyses  of  the  various  measures.  Thus,  we  can  evaluate 
changes  to  the  network  in  response  to  sanctions  over  time. 

In  order  to  explore  this  methodology  the  team  selected  ten  random  entities,  a  mixture  of 
people  and  organizations,  from  a  list  of  people  and  organizations  linked  to  the  Iranian 
nuclear  program.  The  list  was  compiled  using  Iran  Watch  (iranwatch.org),  an  open  data 
source,  and  then  links  were  created  between  the  selected  nodes  to  mimic  an  actual 
network.  This  initial  network  is  illustrated  in  Figure  1. 

Figure  1  illustrates  the  network  at  Time  1 .  (We  have  elected  to  use  Time  1  as  our  initial 
network  state.)  It  is  an  unweighted,  directed  network  meaning  each  link  has  a  value  of 
one  and  links  are  directed  from  the  source  to  the  target. 
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Time  Step  1 


Figure  1 :  Snapshot  of  the  network  at  Time  1  oriented  such  that  the  node  with  the  highest 
betweenness  is  located  at  the  center.  Green  nodes  represent  agents  and  red  nodes  represent 

organizations. 

The  network  was  then  perturbed  in  two  different  time  steps.  In  the  first  step,  Time  1  to 
Time  2,  as  illustrated  in  Figure  2,  we  created  a  scenario  in  which  the  Nuclear  Fuel 
Production  and  Procurement  Company  was  rendered  unable  to  transfer  money 
wirelessly  due  to  a  computer  virus.  Consequently,  the  Nuclear  Fuel  Production  and 
Procurement  Company  would  lose  several  connections  to  other  nodes  in  the  network. 

In  the  second  step,  Time  2  to  Time  3,  as  illustrated  in  Figure  3,  we  examined  the 
structure  of  the  previous  network  if  a  node  was  removed.  In  this  scenario,  we  arbitrarily 
removed  Ali  Akbar  Yahya  from  the  network  so  that  all  of  his  connections  within  the 
network  would  no  longer  exist.  Following  this  fictional  scenario,  the  team  was  able  to 
capture  the  evolution  of  this  network. 


Network  Science  Center  at  West  Point 
www.westpoint.edu/nsc 
845.938.0804 


Time  Step  2 


Figure  2.  Illustration  of  the  example  network  at  Time  2,  after  the  Nuclear  Fuel  and  Procurement 

Company  links  were  disrupted. 

Time  Step  3 


Figure  3.  Network  structure  at  Time  3  after  removal  of  Ali  Akbar  Yahya. 
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To  initiate  this  time  series  analysis,  the  team  first  calculated  several  centrality  measures 
of  the  network  across  each  time  step.  These  centrality  measures  quantify 
characteristics  of  a  given  node.  The  team  selected  the  following  four  commonly  used 
centrality  measures:  degree,  betweenness,  closeness,  and  eigenvector  centrality: 

•  Degree  centrality:  a  measure  of  how  many  connections  a  node  has  within  the 
network. 

•  Betweenness  centrality:  a  measure  of  how  often  a  node  acts  as  an  intermediary 
between  other  nodes  in  a  network.  It  represents  how  many  shortest  paths  go 
through  the  given  node. 

•  Closeness  centrality:  a  measure  of  the  average  length  of  the  paths  from  a  given 
node  to  all  other  nodes. 

•  Eigenvector  centrality:  a  measure  of  the  importance  of  a  node  based  on  the 
number  of  connections  it  shares  with  other  important  nodes. 

All  of  these  measures  are  normalized  to  have  a  value  between  zero  and  one.  This 
makes  it  possible  to  compare  the  influence  of  nodes  within  the  network  under  analysis. 

In  this  situation,  it  allows  us  to  compare  the  structure  of  the  network  as  it  changes  over 
time. 

Analysis  and  Results:  Node-level  Analysis 

Table  1  illustrates  each  node’s  initial  characteristics  in  terms  of  the  four  centrality 
measures.  As  visualized  in  Figure  1 ,  Zari  Mohamed  AN  is  the  most  central  node  in  the 
network  and  also  has  the  highest  betweenness  value  (.124).  In  fact,  the  only  other  node 
with  a  similar  betweenness  value  (.113)  is  Mohammad  Ali  Jafari.  The  other  nodes  in  the 
network  have  much  lower  betweenness  values.  For  instance,  Mohsen  Fadavi’s 
betweenness  in  the  network  (.062)  is  half  as  much  as  Mohamed  Ali’s  (.062/.  124). 

Interestingly,  Mohamed  Ali  does  not  have  the  highest  closeness  value.  Karl  Lee’s  value 
is  (.81 8/. 692)  almost  1.2  times  great  that  Mohamed  Ali’s.  This  finding  demonstrates  the 
value  of  network  analysis;  a  visual  inspection  would  not  lead  to  this  discovery. 

Mohamed  Ali  and  Ali  Jafari  both  share  the  same  eigenvector  value  (.507)  indicating  their 
connectedness  to  the  other  influential  nodes  in  this  network.  Karl  Lee  and  the  Iran 
Aircraft  Manufacturing  Company  also  have  high  values  (,473)-another  finding  that  would 
likely  not  be  possible  without  network  analysis  techniques. 
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Degree 

Betweenness 

Closeness 

Eigenvector 

Karl  Lee  (aka  Li  Fanqwei) 

0.611 

0.036 

0.818 

0.473 

Mohammad  AM  Jafari 

0.611 

0.113 

0.750 

0.507 

AM  Akbar  Yahya 

0.556 

0.055 

0.692 

0.424 

Mohsen  Fadavi 

0.556 

0.062 

0.692 

0.402 

Zari  Mohamed  AM 

0.722 

0.124 

0.692 

0.507 

Bank  Melli 

0.278 

0.004 

0.563 

0.302 

Iran  Aircraft  Manufacturing 
Company 

0.556 

0.058 

0.692 

0.473 

Khatam  ol  Anbia 

0.500 

0.018 

0.643 

0.424 

Nuclear  Fuel  Production  and 
Procurement  Company 

0.500 

0.038 

0.750 

0.461 

Passive  Defense 

Organization 

0.556 

0.061 

0.643 

0.461 

Table  1.  Table  of  all  nodes’  four  major  centrality  measures  at  Time  1. 


An  innovative  way  to  analyze  this  network  is  through  the  use  of  a  two-dimensional  plot 
comparing  two  of  the  centrality  measures.  In  this  case,  the  team  selected  eigenvector 
and  betweenness  centrality  because  of  their  different  mathematical  properties. 
Betweenness  calculates  a  measure  of  shortest  paths  and  effectively  quantifies  how 
each  node  connects  sub-groups  within  the  network.  Eigenvector  measures  the  influence 
of  nodes  one  link  away  from  the  node  under  analysis  and  is  a  measure  of  real  influence 
in  the  network.  The  team  has  found  that  the  ability  to  compare  these  two  particular 
characteristics  lend  great  insight  into  the  holistic  character  of  each  node.  The  graph 
presented  in  Figure  4  demonstrates  this  technique. 


Betweenness 


Eigenvector  vs.  Betweenness 


Time  Step  1 


Nuclear  Fuel 
And 

Procurement 

Company 


Figure  4.  Two-dimensional  plot  of  the  mean  plus  or  minus  one  standard  deviation  for  each 

measure  shown. 
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The  two  dimensional  plot  in  Figure  4  is  divided  into  quadrants  (labeled  A,  B,  C,  and  D) 
by  two  lines  that  lie  at  the  mean  values  of  eigenvector  (vertical)  and  betweenness 
(horizontal)  centralities.  Each  quadrant  highlights  characteristics  particular  to  the  nodes 
in  that  quadrant.  The  nodes  within  the  blue  region  have  centrality  values  within  one 
standard  deviation  of  the  mean.  Nodes  within  this  region  would  be  considered  less 
influential  because  their  values  are  not  significantly  less  than  or  greater  than  the  mean. 
The  nodes  that  lie  beyond  one  standard  deviation  from  the  mean  of  the  centrality 
measures  are  those  of  interest  and  deserve  a  closer  analysis. 

Nodes  that  fall  within  Quadrant  B  (high  in  betweeness  centrality)  tend  to  connect  groups 
in  the  network  and  we  have  designated  them  Gatekeepers.  Nodes  in  Quadrant  D  (high 
in  eigenvector  centrality)  tend  to  be  connected  to  other  influential  nodes  and  we  have 
designated  them  Brokers.  The  nodes  in  the  Quadrant  A  (both  high  in  betweenness  and 
eigenvector)  are  both  Gatekeepers  and  Brokers.  This  combination  of  high  values  in  both 
of  the  centrality  measures  would  indicate  some  of  the  most  influential  agents  or 
organizations  in  the  network.  Nodes  that  fall  into  the  lower  left  quadrant  have  both  low 
betweenness  and  eigenvector  values  and  we  have  designated  them  Peripheral  Players. 
For  example,  in  this  model  the  Nuclear  Fuel  and  Procurement  Company  is  a  Broker  and 
Bank  Melli  is  a  Peripheral  Player. 

As  discussed  earlier,  at  Time  2  we  simulated  that  the  Nuclear  Fuel  and  Procurement 
Company  is  attacked  by  a  computer  virus  that  hinders  its  ability  to  transfer  money,  it 
might  lose  its  connections,  thereby  altering  the  network. 

In  Figure  2,  a  red  circle  surrounds  the  node  corresponding  to  the  Nuclear  Fuel 
Production  and  Procurement  Company.  By  comparing  to  Figure  1,  a  visual  inspection 
verifies  that  the  node  has  lost  all  of  its  incoming  links  and  one  of  its  outgoing  links.  The 
loss  of  links  will  change  the  network  structure.  These  changes  can  be  measured  using 
centrality  measures. 

Table  2  illustrates  that  every  centrality  measure  decreased  for  the  company  from  Time  1 
to  Time  2.  The  smaller  total  degree  centrality  confirms  that  that  there  were  fewer  links 
at  Time  2  than  at  Time  1 .  Another  measure  that  should  be  considered  is  betweenness 
centrality  as  it  decreased  to  zero  from  Time  1  to  Time  2.  This  shows  that  the  Nuclear 
Fuel  Production  and  Procurement  Company  lost  its  role  as  an  intermediary  in  the 
network.  The  computer  virus  that  was  responsible  for  the  loss  of  the  company’s 
connections  was  successful  in  severely  reducing  its  importance  to  flow  across  the 
network. 
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Centrality 

Time  1 

Time  2 

Degree 

0.500 

0.222 

Betweenness 

0.038 

0.000 

Closeness 

0.750 

0.643 

Eigenvector 

0.461 

0.280 

Table  2.  Table  of  the  four  major  centrality  measures  of  the  Nuclear  Fuel  Production  and 
Procurement  Company  at  the  first  two  time  steps 

We  can  gain  more  information  about  the  network’s  dynamics  by  again  plotting  nodes’ 
eigenvector  centrality  against  betweenness  centrality  (Figure  5) 

Figure  5  is  structured  in  the  same  way  as  Figure  4.  Comparing  the  two  plots,  we  find 
that  the  network  experienced  major  structural  changes.  The  graph  of  the  nodes’ 
centrality  measures  became  more  condensed.  The  nodes  cluster  around  the  mean 
and,  unlike  Figure  4;  there  are  only  three  nodes  that  lie  outside  the  blue  region.  These 
are  the  nodes  that  should  be  further  investigated.  Also,  the  eigenvector  centrality  of  the 
Nuclear  Fuel  and  Procurement  Company  decreased  from  Time  1  to  Time  2  implying  that 
it  now  has  a  different  role  in  the  network.  It  has  evolved  from  a  Broker  role  to  a 
Peripheral  Player.  However,  even  though  the  degree  centrality  of  Bank  Melli  decreased, 
it  remained  in  its  original  quadrant  and  therefore  its  role  did  not  change. 


Eigenvector  vs.  Betweenness 
Time  Step  2 


Bank  Melli 


Nuclear  Fuel  and  Procurement  Company 


Figure  5.  Two  dimensional  plot  of  eigenvector  centrality  vs.  betweenness  centrality  with  the 
means  plus  or  minus  one  standard  deviation  identified. 

The  second  time  step  demonstrated  how  the  loss  of  several  links  could  affect  the 
network.  Another  situation  to  consider  is  node  deletion.  As  explained  in  the 
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Methodology  section,  the  team  decided  to  delete  a  node  at  Time  Step  3.  To  analyze  the 
impact  of  such  an  event,  AN  Akbar  Yahya  was  removed  from  the  network. 

Similar  to  Figures  1  and  2,  Figure  3  illustrates  a  network  that  is  structured  so  the  node 
with  the  highest  betweenness  centrality  is  located  at  the  center.  The  removal  of  AN 
Akbar  Yahya  brought  Mohammad  AN  Jafari  to  this  position.  The  network  was 
restructured  in  response  to  the  perturbation,  and  as  a  result,  the  characteristics  of  some 
of  the  nodes  have  evolved.  Figure  6  illustrates  these  changes  using  a  2-D  centrality 
plot  similar  to  Figures  4  and  5. 

The  removal  of  a  member  of  the  network  caused  a  disruption  that  affected  the  centrality 
measures  of  all  of  other  nodes.  For  instance,  the  Nuclear  Fuel  and  Procurement 
Company  changed  from  Quadrant  D  to  C.  This  illustrates  that  nodes  in  a  network  are 
indirectly  connected  to  other  nodes  by  paths  of  length  greater  than  one.  Even  though 
the  Nuclear  Fuel  and  Procurement  Company  and  AN  Akbar  Yahya  were  not  adjacent, 
the  Nuclear  Fuel  and  Procurement  Company  was  affected  by  AN  Akbar  Yahya’s 
removal  from  the  network  because  the  nodes  were  indirectly  connected  by  paths  that 
pass  through  other  intermediary  nodes. 
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Figure  6.  Two  Dimensional  graph  of  eigenvector  and  betweenness  centrality  measures  at  Time  3, 
after  Ali  Akbar  Yahya  was  removed  from  the  network. 
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Analysis  and  Results:  Network-level  Analysis 

When  performing  a  time  series  analysis  it  is  also  valuable  to  examine  measures  on  the 
network  level,  rather  than  the  individual  node  level.  This  provides  a  broader  view  of  the 
network  by  providing  measures  that  take  into  account  all  present  nodes  and  links. 

These  measures  are  called  network  centralization  measures.  They  allow  us  to  compare 
the  same  network  at  different  time  periods.  For  example,  betweenness  centralization 
measures  how  susceptible  a  network  is  to  fracture.  Table  3  contains  values  of  this 
network  centralization  measure  at  the  three  time  steps  for  our  demonstration  network. 


Time  Step 

Betweenness  Centralization 

1 

0.075 

2 

0.090 

3 

0.090 

Table  3.  Table  of  betweenness  centralization  measures  over  the  three  described  time  steps 

The  betweenness  centralization  of  the  example  network  increased  from  Time  1  to  Time 
2  indicating  that  the  network  became  more  susceptible  to  fracture.  However,  from  Time 
2  to  Time  3  the  betweenness  centralization  did  not  change,  implying  that  whatever 
changes  were  made  had  little  effect  on  the  network. 

Another  measure  to  consider  is  network  density.  This  is  a  measure  of  how  many  links 
are  in  the  network  compared  to  the  maximum  number  of  links  that  could  possibly  be 
present.  The  actual  measure  for  a  directed  network  is  defined  as  the  ratio  of  the 
number  of  edges  E  to  the  number  of  possible  edges  or: 

2E 

1) 

where  N  is  the  total  number  of  nodes  present  in  the  network. 


Time  Step 

Density 

1 

0.544 

2 

0.489 

3 

0.528 

Table  4.  Table  of  density  of  example  network  over  three  time  steps. 

Table  4  shows  that  this  particular  network  maintains  a  high  density  because  of  the  small 
number  of  nodes  combined  with  the  large  number  of  links.  The  changes  observed 
between  time  steps  are  relatively  small,  but  still  worth  noting  as  they  indicate  changes  in 
network  structure.  Between  Time  1  and  Time  2  several  links  were  removed.  This 
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resulted  in  a  smaller  percentage  of  possible  links  and  therefore  a  lower  density.  Then,  a 
node  was  removed  between  Time  2  and  Time  3.  With  fewer  nodes  present,  the  number 
of  possible  links  decreased  and  led  to  an  increased  density. 

These  network  measures  allow  for  an  overall  view  that  takes  into  account  all  of  the 
nodes  and  links  at  once  and  can  be  calculated  for  any  network.  In  turn,  decision¬ 
makers  are  able  to  quickly  determine  the  structure  and  stability  of  a  data  set. 

Discussion  of  Results 

This  demonstration  network  analysis  illustrates  the  numerous  network  analysis  methods 
that  can  be  utilized  in  order  to  better  understand  the  impact  and  effectiveness  of 
sanction  imposition. 

The  node-level  analysis  techniques  allow  an  analyst  to  accurately  determine  the 
evolution  of  the  network  based  on  the  perturbation.  For  instance,  the  impact  on  the 
Nuclear  Fuel  and  Procurement  Company  based  on  the  activation  of  a  computer  virus 
( Time  1  to  Time  2)  is  readily  apparent.  A  deeper  analysis  of  this  network  would  include 
a  determination  of  the  nodes  that  became  more,  or  less,  influential  in  the  network  based 
on  this  event.  With  improved  data,  this  technique  also  allows  analysts  to  determine  if  the 
affected  nodes  themselves  evolve.  For  instance,  if  an  organization  is  impacted  by  a 
sanction  it  might  re-organize  and  effectively  become  two  or  more  nodes  and  establish 
new  links. 

The  network-level  analysis  techniques  enable  analysts  to  better  understand  the  holistic 
network  and  determine  more  effective,  focused,  sanction  strategies.  For  example,  the 
analysis  might  recommend  targeted  sanctions  that  have  a  goal  of  weakening  the 
network  at  large,  which  can  potentially  make  it  more  fragile  in  the  long  run.  Our 
colleagues  here  at  West  Point  have  recently  developed  an  example  of  such  a 
technique.  Their  algorithm  determines  nodes  in  a  network  to  eliminate  with  a  goal  of 
making  the  network  fragile  eventually  allowing  a  single  action  to  fracture  the  network  [6], 

Conclusion 

Network  time  series  analysis  is  a  valuable  tool  for  examining  the  evolution  of  networks. 
Creating  a  timeline  of  a  network’s  evolution  provides  powerful  insights  into  how  the 
network  reacts  to  both  negative  and  positive  perturbations.  Based  on  the  successful 
insights  gained  from  this  demonstration  data  set,  the  team  is  currently  coordinating  with 
several  agencies  in  an  attempt  to  access  accurate  time-stamped  data  sets.  This  data 
will  allow  us  to  more  accurately  analyze  the  effectiveness  of  past  sanctions  against 
organizations  involved  in  the  Iranian  nuclear  program.  As  we  refine  these  analytical 
techniques,  we  hope  to  enable  analysts  to  develop  “smarter  sanctions”  that  are  more 
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narrowly  targeted  and  influence  the  network  in  order  to  achieve  the  desired  outcome 
without  the  potential  collateral  impact  of  broad  sanctions. 
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